Covert Channel Attacks Research Articles

A Review on Network Covert Channel Construction and Attack Detection

ABSTRACTA covert network channel is a communication channel in which the message is secretly transmitted to the recipient. Sometimes, covert network channels are vulnerable to multiple attacks. Therefore, the message must be properly secure. In most cases, the covert channel is used to ensure data protection and allow users to freely access the Internet. In this paper, several recent studies are reviewed on covert network channels and examine the existing works from 2015 to 2024. This review article also discusses the undetectability and reliability of different types of covert network channels. Furthermore, a detailed description of the covert network channel's ability to hide in containers is provided. Existing research on covert network channels explains a few techniques for detecting attacks in secret data communication. However, several machine learning and deep learning techniques have been discussed in this article. Additionally, this article describes the accuracy of detection through an overview of current technologies. In addition, various countermeasures to prevent attacks in covert channels are also discussed in detail. However, in this case, the bandwidth limitations, data set limitations, and covert channel capacity are clearly defined, which will help future researchers build covert network channels and detect attacks. Finally, this work considers the challenges faced by covert network channels and the future scope of application.

A Survey of of Side-Channel Attacks and Mitigation for Processor Interconnects

With advancements in chip technology, the number of cores in modern commercial processors continues to rise, leading to increased complexity in interconnects and on-chip networks. This complexity, however, exposes significant security vulnerabilities, primarily in the form of side-channel and covert-channel exploits. Unlike other microarchitectural side-channel attacks, those leveraging on-chip interconnects utilize unique characteristics, allowing attackers to develop novel methods that can bypass existing effective defenses. In this paper, we present a comprehensive survey of current side-channel and covert-channel attacks based on processor-on-chip interconnects. We categorize these attacks into three types: contention-based, distance-based, and layout-based, according to the specific interconnect characteristics they exploit, and discuss corresponding countermeasures for each. Finally, we provide an outlook on future development trends in processor interconnect side channels. This survey is the first to specifically focus on interconnect-based side channels in processors.

RSPP: Restricted Static Pseudo-Partitioning for Mitigation of Cross-Core Covert Channel Attacks

Cache timing channel attacks exploit the inherent properties of cache memories: hit and miss time along with the shared nature of the cache to leak secret information. The side channel and covert channel are the two well-known cache timing channel attacks. In this article, we propose Restricted Static Pseudo-Partitioning (RSPP), an effective partition-based mitigation mechanism that restricts the cache access of only the adversaries involved in the attack. It has an insignificant impact of only 1% in performance, as the benign processes have access to the full cache and restrictions are limited only to the suspicious processes and cache sets. It can be implemented with a maximum storage overhead of 1.45% of the total Last-Level Cache (LLC) size. This article presents three variations of the proposed attack mitigation mechanism: RSPP, simplified-RSPP (S-RSPP) and corewise-RSPP (C-RSPP) with different hardware overheads. A full system simulator is used for evaluating the performance impact of RSPP. A detailed experimental analysis with different LLC and attack parameters is also discussed. RSPP is also compared with the existing defense mechanisms effective against cross-core covert channel attacks.

A comparative study of covert channel attacks in Android with different parameters and detection tools

A comparative study of covert channel attacks in Android with different parameters and detection tools

A comparative study of Covert Channel attacks in Android with different parameters and detection tools

A comparative study of Covert Channel attacks in Android with different parameters and detection tools

Laser-based Covert Channel Attack Using Inaudible Acoustic Leakage from Multilayer Ceramic Capacitors

Laser-based Covert Channel Attack Using Inaudible Acoustic Leakage from Multilayer Ceramic Capacitors

Packet Length Covert Channel Detection: An Ensemble Machine Learning Approach

New undetectable attack methods made possible by advances in covert channel techniques. Due to their nonstandard data transfer methods, common countermeasures are ineffective. The detection, mitigation, and elimination of hidden channels that operate on the packet length level are extremely challenging problems. Differences in packet size can be used as part of a covert communication strategy for the delivery of sensitive information across networks. The use of machine learning techniques for detecting covert channel attacks has been praised in recent academic research. Researchers in this work developed an effective ensemble classification method for spotting such breaches. Our approach relies on an ensemble model, which is a combination of three different machine learning methods. There are several applications for classifiers including the Support Vector Machine (SVM), Random Forest (RF), and Naive Bayes (NB). The logistic regression (LR) classifier served as a meta classifier to aggregate the results of the component classifiers into an ensemble classifier. According to the findings, the proposed ensemble model is effective. Among single-classification algorithms, it is unrivalled in its ability to detect such covert channel attacks.

Detecting covert channel attacks on cyber‐physical systems

AbstractCyberattacks on cyber‐physical systems (CPS) have the potential to cause widespread disruption and affect the safety of millions of people. Machine learning can be an effective tool for detecting attacks on CPS, including the most stealthy types of attacks, known as covert channel attacks. In this study, the authors describe a novel hierarchical ensemble architecture for detecting covert channel attacks in CPS. Our proposed approach uses a combination of TCP payload entropy and network flows for feature engineering. Our approach achieves high detection performance, shortens the model training duration, and shows promise for effective detection of covert channel communications. This novel architecture closely mirrors the CPS attack stages in real‐life, providing flexibility and adaptability in detecting new types of attacks.

Detection of Thermal Covert Channel Attacks Based on Classification of Components of the Thermal Signal Features

In response to growing security challenges facing many-core systems imposed by thermal covert channel (TCC) attacks, a number of threshold-based detection methods have been proposed. In this paper, we show that these threshold-based detection methods are inadequate to detect TCCs that harness advanced signaling and specific modulation techniques. Since the frequency representation of a TCC signal is found to have multiple side lobes, this important feature shall be explored to enhance the TCC detection capability. To this end, we present a pattern-classification-based TCC detection method using an artificial neural network that is trained with a large volume of spectrum traces of TCC signals. After proper training, this classifier is applied at runtime to infer TCCs, should they exist. The proposed detection method is able to achieve a detection accuracy of 99%, even in the presence of the stealthiest TCCs ever discovered. Because of its low runtime overhead ( <inline-formula><tex-math notation="LaTeX">$&lt; 0.187\%$</tex-math></inline-formula> ) and low energy overhead ( <inline-formula><tex-math notation="LaTeX">$&lt; 0.072\%$</tex-math></inline-formula> ), this proposed detection method can be indispensable in fighting against TCC attacks in many-core systems. With such a high accuracy in detecting TCCs, powerful countermeasures, like the ones based on dynamic voltage and frequency scaling (DVFS), can be rightfully applied to neutralize any malicious core participating in a TCC attack.

CASPER: Covert Channel Using Internal Speakers

In recent years, researchers have studied various methods for transferring data in a network-separated environment, and the most representative method is the use of inaudible frequency signals like ultrasonic waves. This method has the advantage of being able to transfer data without other people noticing, but it has the disadvantage that speakers must exist. In a laboratory or company, external speakers may not be attached to each computer. Therefore, this paper presents a new covert channel attack that transfers data using internal speakers on the computer's motherboard. The internal speaker can also produce a sound of the desired frequency, and, therefore, data can be transferred using high frequency sounds. We encode data into Morse code or binary code and transfer it. Then we record it using a smartphone. At this time, the location of the smartphone can be any distance within 1.5 m when the length per bit is longer than 50 ms, such as on the computer body or on the desk. Data are obtained by analyzing the recorded file. Our results show that data is transferred from a network-separated computer using an internal speaker with 20 bits/s in maximum.

Covert Channel Communication as an Emerging Security Threat in 2.5D/3D Integrated Systems.

In this paper, first, a broad overview of existing covert channel communication-based security attacks is provided. Such covert channels establish a communication link between two entities that are not authorized to share data. The secret data is encoded into different forms of signals, such as delay, temperature, or hard drive location. These signals and information are then decoded by the receiver to retrieve the secret data, thereby mitigating some of the existing security measures. The important steps of covert channel attacks are described, such as data encoding, communication protocol, data decoding, and models to estimate communication bandwidth and bit error rate. Countermeasures against covert channels and existing covert channel detection techniques are also summarized. In the second part of the paper, the implications of such attacks for emerging packaging technologies, such as 2.5D/3D integration are discussed. Several covert channel threat models for 2.5D/3D ICs are also proposed.

Modeling and Analysis of Thermal Covert Channel Attacks in Many-core Systems

In a many-core chip, thermal flux and thermal correlation among the cores can be explored to create a thermal covert channel (TCC). In this paper, we provide an analytical model to quickly determine the key TCC performance metrics, in terms of bit error rate (BER), signal to noise ratio (SNR), and channel capacity, without going through lengthy computer simulation and/or physical experiments that are normally needed in current TCC performance studies. According to our model, the TCC’s BER is proportional to the square root of the transmission frequency, which can be explored quantitatively to boost the TCC’s transmission efficiency by letting the TCC’s thermal signal be transmitted at a higher frequency. In addition, our proposed model also links the jamming noise and application of Dynamic Voltage Frequency Scaling (DVFS) to TCC’s BER performance, a feature that can be explored to design/optimize the countermeasures against the TCC attacks. The TCC performance predicted by the proposed theoretical model is found in a good agreement with that obtained from computer simulations, with an average error lower than 7%.

Characterization and Detection of Cross-Router Covert Channels

In covert channel attacks, an adversary seeks various means to influence a tangible characteristic of a system, and then makes the systems leak information by measuring this characteristic. Covert channels are, by nature, very elusive. This makes it very difficult to identify them and defend against attacks that use these channels to leak sensitive information. Thus, they are a serious threat to the security of many systems.In this paper, we present two network timing covert channel attacks, and a defense mechanism against them. The purpose of the proposed attacks is to leak sensitive information between two logically separated (or isolated) networks that are hosted by a single router – one that is connected to the Internet, and another that is isolated and contains sensitive information. The attacks build on the fact that the response time of the router for a specific type of packet sent from a device that is connected to it is usually predictable, given the network topology. By interacting with the single shared router in a specific manner, an attacker can increase the router’s packet response time. The interaction is determined based on the information to be leaked, so the receiver (a computer located on the Internet-connected network) can measure the delayed packet response times and decode the sender’s signals (which operates from the isolated network) to receive classified information. The two classes of attacks presented in this work differ in the way that the delay is caused. In the cross-router covert channel (CRCC) attack, the sender overloads the router with control-plane packets; in the Wi-Fi micro-jamming attack, the sender uses a pre-installed implant to transmit single-tone signals in the 2.4GHz frequency range, disturbing the router’s packet transmissions. We showed that both attacks can influence a wide range of router brands and Wi-Fi capable devices and evaluated the optimal settings for both attacks when using different types of packets, transmission power, and data transmission rates.Our proposed defense mechanism is based on semi-supervised machine learning and deep learning algorithms, which are both used for novelty detection in network traffic. By detecting unusual traffic, we can identify the disturbances needed to leak the information. The system can then respond by blocking the suspicious devices that are involved in the attack. We evaluated the attacks in noisy and noise-free environments, successfully detecting both attacks in both environments. All the data and code, which includes the implementation of the attacks and the defense mechanism, is published as a benefit to the research community.

TPPD: Targeted Pseudo Partitioning based Defence for cross-core covert channel attacks

Contemporary computing employs cache hierarchy to fill the speed gap between processors and main memories. In order to optimise system performance, Last Level Caches (LLC) are shared among all the cores. Cache sharing has made them an attractive surface for cross-core timing channel attacks. In these attacks, an attacker running on another core can exploit the access timing of the victim process to infiltrate the secret information. One such attack is called a cross-core Covert Channel Attack (CCA). Timely detection and then prevention of cross-core CCA is critical for maintaining the integrity and security of users, especially in a shared computing environment. In this work, we have proposed an efficient cross-core CCA mitigation technique. We propose a way-wise cache partitioning on targeted sets, only for the processes suspected to be attackers. In this way, the performance impact on the entire LLC is minimised, and benign applications can utilise the LLC to its full capacity. We have used a cycle-accurate simulator (gem5) to analyse the performance of the proposed method and its security effectiveness. It has been successful in abolishing the cross-core covert timing channel attack with no significant performance impact on benign applications. It causes 23% less cache misses in comparison to existing partitioning based solutions while requiring ≈0.26% storage overhead.

Inaudible sound covert channel with anti-jamming capability: Attacks vs. countermeasure

When an inaudible sound covert channel (ISCC) attack is launched inside a computer system, sensitive data are converted to inaudible sound waves and then transmitted. The receiver at the other end picks up the sound signal, from which the original sensitive data can be recovered. As a forceful countermeasure against the ISCC attack, strong noise can be used to jam the channel and literally shut down any possible sound data transmission. In this paper, enhanced ISCC whose transmission frequency can be dynamically changed is proposed. Essentially, if the transmitter detects that the covert channel is being jammed, the transmitter and receiver both will switch to another available frequency and re-establish their communications, following the proposed communications protocol. Experimental results show that the proposed enhanced ISCC can remain connected even in the presence of a strong jamming noise source. Correspondingly, a detection method based on frequency scanning is proposed to help to combat such an anti-jamming sound channel. With the proposed countermeasure, the bit error rate (BER) of the data communications over enhanced ISCC soars to more than 48%, essentially shutting down the data transmission, and thus neutralizing the security threat.

Combating Stealthy Thermal Covert Channel Attack With Its Thermal Signal Transmitted in Direct Sequence Spread Spectrum

Many-core systems are susceptible to attacks launched by thermal covert channel (TCC) attacks. Detection of TCC attacks often relies on the use of threshold-based approaches or variants, and a countermeasure to thwart the channel can be applied only after an attack is deemed to be present. In this article, we describe a direct sequence spread spectrum (DSSS)-based TCC, where its thermal data are modulated by a pseudo-random bit sequence. Unfortunately, such DSSS-based TCC has an extremely low signal strength that the signal is nearly indistinguishable from the noise and thus cannot be detected by any existing threshold-based detection methods. To combat this stealthy TCC, we propose a novel detection scheme that lets the received signal pass through a differential filter where irrelevant frequency components occupied mainly by the noise gets eliminated and the filtered signal is next compared against a threshold for successful detection. Experimental results show that the DSSS-based TCC can effectively survive detection by the existing detection methods with its BER as low as 4%. In contrast, with the proposed detection and countermeasure applied, the detection accuracy jumps to 89%, and the BER of the DSSS-based TCC soars to 50%, which indicates that the TCC is practically shut down.

A generalized approach to estimation of memoryless covert channel information leakage capacity

Estimating the amount of information that is leaked by covert channels is a necessity to comprehend and mitigate the severity of attacks exploiting these channels. Having such an estimation in design-state provides an opportunity for designers to adjust their systems to minimize information leakage. In this paper, we propose a methodology to estimate the worst-case information leakage (or capacity for the information leakage) through various memoryless covert channels – both analog and digital ones – exhibiting on–off keying structure. In that respect, we first model the communication channel as a deletion–insertion channel to account for the information losses due to software activities. Then, we derive the effective noise in covert channels as the combination of jitter noise caused by signaling time variation and Additive White Gaussian Noise (AWGN). Considering this effective noise, we propose a communication model which can be generalized for various covert channels and takes insertions, deletions, and asynchronous nature of covert channels into account. By leveraging the link between this communication model and information theory literature, we obtain the information leakage capacity that reveals the leakage limit for the worst-case scenarios. Finally, we provide experimental results to demonstrate that the proposed model is an effective and a generalized methodology to score the resilience of a given system to covert channel attacks.

Selective Noise Based Power-Efficient and Effective Countermeasure against Thermal Covert Channel Attacks in Multi-Core Systems

With increasing interest in multi-core systems, such as any communication systems, infra-structures can become targets for information leakages via covert channel communication. Covert channel attacks lead to leaking secret information and data. To design countermeasures against these threats, we need to have good knowledge about classes of covert channel attacks along with their properties. Temperature–based covert communication channel, known as Thermal Covert Channel (TCC), can pose a threat to the security of critical information and data. In this paper, we present a novel scheme against such TCC attacks. The scheme adds selective noise to the thermal signal so that any possible TCC attack can be wiped out. The noise addition only happens at instances when there are chances of correct information exchange to increase the bit error rate (BER) and keep the power consumption low. Our experiments have illustrated that the BER of a TCC attack can increase to 94% while having similar power consumption as that of state-of-the-art.

Dropping malware through sound injection: A comparative analysis on Android operating systems

Trojan droppers are regularly ranked among the top 5 worst malware threats; especially for Android. Software for malware detection opts to either identify the payload when executed in memory or detect the connection from which droppers attempt to download malicious payloads. Much effort has been put into securing network channels and stopping droppers from delivering their payloads. This paves the way for alternative routes of infiltration. Our paper extends work on inaudible sound covert channel attacks and audio fingerprinting to use them for close vicinity attacks as potential mass dropper techniques. We demonstrate that malware modules can be dropped over the air to multiple devices using the same sound medium from approximately four to five meters away. Instead of using network connections, we conceal the malware within musics inaudible frequencies. Then we use a seemingly innocent app that implements an algorithm similar to Shazams audio fingerprinting to transmit the payload over the devices microphone and execute it. To accomplish this, we combine Short-Time Discrete Fourier Transform, peak frequency mapping and dilation techniques to a Meterpreter payload as fluctuations in magnitude within inaudible frequencies. To our knowledge, there is currently no technique capable of transmitting payloads to multiple neighboring systems without discrete network connections between the payload remote location and the device. We, therefore, present realistic attack cases and provide solutions for these attack vectors, including modulation and high-peak compression of sound dependent channel frequencies.

Combating Enhanced Thermal Covert Channel in Multi-/Many-Core Systems With Channel-Aware Jamming

As a means to thwart thermal covert channel attack in a multi-/many-core system, a strong heat noise whose frequency band coincides with that occupied by the thermal covert channel is injected to jam the channel. However, this undiscriminating channel jamming-based countermeasure will fail if a thermal covert channel is allowed to change its transmission frequency dynamically in response to the jamming. To combat this enhanced thermal covert channel, a more advanced countermeasure is needed and thus proposed that checks the frequency spectrum and tracks any possible covert channel. Only after a channel is detected to be susceptible, a thermal noise with this channel frequency is then emitted to jam the covert channel. The communication protocols and frequency changing scheme pertaining to this enhanced thermal covert channel are described in this article. The experimental results confirm that, when the proposed countermeasure is applied, the enhanced thermal covert channel, much more resilient to jamming, suffers from an extremely high packet error rate (PER), which makes any meaningful data leakage practically impossible. As the proposed countermeasure method is poised to contain dangerous thermal covert channel attacks with an anti-jamming capability, it lends itself well to secure multi-/many-core systems.